https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 19:35:11 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-379756 EUVD-2026-379756 https://cve.radiocsirt.org/vuln/euvd-2026-379756 https://cve.radiocsirt.org/vuln/fkie_cve-2026-102828 <p>simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. From 3.15.0 until 4.0.1, the default blockUnsafeOperationsPlugin does not classify trailer.&lt;token&gt;.cmd as unsafe configuration. An application that passes attacker-controlled values through SimpleGitOptions.config or inline -c arguments can therefore allow Git to invoke an attacker-selected shell command when git interpret-trailers processes the configured trailer. The command executes with the operating-system identity and permissions of the Node.js process. This issue is fixed in 4.0.1.</p> <p>simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. From 3.15.0 until 4.0.1, the default blockUnsafeOperationsPlugin does not classify trailer.&lt;token&gt;.cmd as unsafe configuration. An application that passes attacker-controlled values through SimpleGitOptions.config or inline -c arguments can therefore allow Git to invoke an attacker-selected shell command when git interpret-trailers processes the configured trailer. The command executes with the operating-system identity and permissions of the Node.js process. This issue is fixed in 4.0.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-102828 https://cve.radiocsirt.org/vuln/ghsa-x6jw-m9v5-85vh <p><strong>Affected:</strong> npm: simple-git</p> <p>## Affected product</p> <p>The default `blockUnsafeOperationsPlugin` in `simple-git` when an application permits untrusted values to reach `SimpleGitOptions.config` or Git inline configuration arguments such as `-c &lt;key&gt;=&lt;value&gt;`.</p> <p>## Summary</p> <p>`trailer.&lt;token&gt;.cmd` is not recognized as unsafe by the default guard. Therefore, a configured inline value reaches Git without a `GitPluginError`.</p> <p>Git documents `trailer.&lt;token&gt;.cmd` as a shell command invoked by `git interpret-trailers`. An application that relies on the default plugin to reject unsafe configuration can therefore execute a command supplied through an untrusted trailer-command configuration value.</p> <p>## Technical details</p> <p>`simple-git/src/lib/git-factory.ts` installs `commandConfigPrefixingPlugin` before `blockUnsafeOperationsPlugin`. The prefixing plugin in `simple-git/src/lib/plugins/command-config-prefixing-plugin.ts` turns every `SimpleGitOptions.config` entry into `-c &lt;key&gt;=&lt;value&gt;` before the unsafe-operation plugin evaluates the final argv.</p> <p>In `simple-git@3.36.0`, `blockUnsafeOperationsPlugin` delegates to `@simple-git/argv-parser`. `packages/argv-parser/src/vulnerabilities/detect-vulnerable-config-writes.ts` compares parsed configuration writes against `preventUnsafeConfig`. That list has no matcher for `trailer.&lt;token&gt;.cmd`, so the invocation is allowed.</p> <p>Git v2.39.5&#39;s `Documentation/git-interpret-trailers.txt` states that `trailer.&lt;token&gt;.cmd` specifies a shell command called to generate or modify a trailer.</p> <p>## P…</p> <p><strong>Affected:</strong> npm: simple-git</p> <p>## Affected product</p> <p>The default `blockUnsafeOperationsPlugin` in `simple-git` when an application permits untrusted values to reach `SimpleGitOptions.config` or Git inline configuration arguments such as `-c &lt;key&gt;=&lt;value&gt;`.</p> <p>## Summary</p> <p>`trailer.&lt;token&gt;.cmd` is not recognized as unsafe by the default guard. Therefore, a configured inline value reaches Git without a `GitPluginError`.</p> <p>Git documents `trailer.&lt;token&gt;.cmd` as a shell command invoked by `git interpret-trailers`. An application that relies on the default plugin to reject unsafe configuration can therefore execute a command supplied through an untrusted trailer-command configuration value.</p> <p>## Technical details</p> <p>`simple-git/src/lib/git-factory.ts` installs `commandConfigPrefixingPlugin` before `blockUnsafeOperationsPlugin`. The prefixing plugin in `simple-git/src/lib/plugins/command-config-prefixing-plugin.ts` turns every `SimpleGitOptions.config` entry into `-c &lt;key&gt;=&lt;value&gt;` before the unsafe-operation plugin evaluates the final argv.</p> <p>In `simple-git@3.36.0`, `blockUnsafeOperationsPlugin` delegates to `@simple-git/argv-parser`. `packages/argv-parser/src/vulnerabilities/detect-vulnerable-config-writes.ts` compares parsed configuration writes against `preventUnsafeConfig`. That list has no matcher for `trailer.&lt;token&gt;.cmd`, so the invocation is allowed.</p> <p>Git v2.39.5&#39;s `Documentation/git-interpret-trailers.txt` states that `trailer.&lt;token&gt;.cmd` specifies a shell command called to generate or modify a trailer.</p> <p>## P…</p> https://cve.radiocsirt.org/vuln/ghsa-x6jw-m9v5-85vh